{"record":{"id":"46b696ec0433568f","repo":"keycloak/keycloak","slug":"eddsa-algorithms-not-supported-in-this-jdk-version","errorCode":null,"errorMessage":"EdDSA algorithms not supported in this JDK version","messagePattern":"EdDSA algorithms not supported in this JDK version","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/keycloak/jose/jwk/EdECUtilsUnsupportedImpl.java","lineNumber":38,"sourceCode":"import java.security.PublicKey;\n\nimport org.keycloak.crypto.KeyUse;\n\n/**\n * <p>Unsupported implementation for old jdk versions.</p>\n *\n * @author rmartinc\n */\nclass EdECUtilsUnsupportedImpl implements EdECUtils {\n\n    @Override\n    public boolean isEdECSupported() {\n        return false;\n    }\n\n    @Override\n    public JWK okp(String kid, String algorithm, Key key, KeyUse keyUse) {\n        throw new UnsupportedOperationException(\"EdDSA algorithms not supported in this JDK version\");\n    }\n\n    @Override\n    public PublicKey createOKPPublicKey(JWK jwk) {\n        throw new UnsupportedOperationException(\"EdDSA algorithms not supported in this JDK version\");\n    }\n}\n","sourceCodeStart":20,"sourceCodeEnd":46,"githubUrl":"https://github.com/keycloak/keycloak/blob/66c7e15a3788de7764f07dd2558275a02770e16d/core/src/main/java/org/keycloak/jose/jwk/EdECUtilsUnsupportedImpl.java#L20-L46","documentation":"Thrown by EdECUtilsUnsupportedImpl.okp when an attempt is made to build an OKP (EdDSA) JWK on a JDK older than 15. JWKBuilder statically loads EdECUtilsImpl (which uses java.security.spec.EdECPublicKeySpec, a Java 15+ API) and falls back to EdECUtilsUnsupportedImpl if that class cannot be loaded. The unsupported impl throws UnsupportedOperationException for any OKP operation. okp() is the key-to-JWK conversion path.","triggerScenarios":"Calling JWKBuilder.okp(...) (or JWKBuilder.algorithm(EdDSA).key(eddsaKey)) to serialize an EdDSA public key into a JWK while running on JDK 11 or earlier, where EdECUtilsImpl fails to load and the unsupported stub is active.","commonSituations":"Running a Keycloak-based app or an embedded jose/jwk utility on Java 11 (still common in legacy deployments) and attempting to register or expose an Ed25519/Ed448 key. The runtime simply lacks the JDK EdEC APIs.","solutions":["Upgrade the runtime to JDK 15+ (Keycloak itself requires Java 17+ in recent versions) so EdECUtilsImpl loads.","Guard with JWKBuilder.EdEC_UTILS.isEdECSupported() before attempting OKP serialization and skip/fallback otherwise.","Use RSA or EC keys instead of EdDSA if the JDK cannot be upgraded."],"exampleFix":"// before\nJWK jwk = JWKBuilder.create().kid(kid).algorithm(Algorithm.Ed25519).key(edKey);\n\n// after\nif (!JWKBuilder.EdEC_UTILS.isEdECSupported()) {\n    throw new IllegalStateException(\"EdDSA requires JDK 15+; current runtime cannot serialize OKP keys\");\n}\nJWK jwk = JWKBuilder.create().kid(kid).algorithm(Algorithm.Ed25519).key(edKey);","handlingStrategy":"type-guard","validationCode":"public static boolean isEdEcAvailable() {\n    return JWKBuilder.EdEC_UTILS.isEdECSupported();\n}","typeGuard":"public static boolean canSerializeOkp(Key key) {\n    return key instanceof java.security.interfaces.EdECPublicKey\n        && JWKBuilder.EdEC_UTILS.isEdECSupported();\n}","tryCatchPattern":"try {\n    JWK jwk = JWKBuilder.create().kid(kid).algorithm(Algorithm.Ed25519).key(edKey);\n} catch (UnsupportedOperationException e) {\n    if (e.getMessage().contains(\"EdDSA\")) {\n        throw new EnvironmentException(\"EdDSA serialization requires JDK 15+\", e);\n    }\n    throw e;\n}","preventionTips":["Check JWKBuilder.EdEC_UTILS.isEdECSupported() before serializing OKP keys.","Run on JDK 15+ (Keycloak 21+ requires 17) to get the real EdECUtilsImpl.","Fall back to RSA/EC keys when the runtime cannot be upgraded."],"tags":["jose","jwk","okp","eddsa","jdk-version","compatibility","keycloak"],"backgroundTag":null,"analyzedSha":"66c7e15a3788de7764f07dd2558275a02770e16d","analyzedAt":"2026-08-14T01:36:42.651Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}